Overview

overview

10

Static

static

7

5d1db00b48...a0.apk

android-9-x86

10

5d1db00b48...a0.apk

android-10-x64

10

5d1db00b48...a0.apk

android-11-x64

10

closebutton.html

windows7-x64

1

closebutton.html

windows10-2004-x64

1

core_wrapper.js

windows7-x64

1

core_wrapper.js

windows10-2004-x64

1

lynx_core.js

windows7-x64

1

lynx_core.js

windows10-2004-x64

1

nd

ubuntu-18.04-amd64

slardar_bridge.js

windows7-x64

1

slardar_bridge.js

windows10-2004-x64

1

slardar_sdk.js

windows7-x64

1

slardar_sdk.js

windows10-2004-x64

1

template.js

windows7-x64

1

template.js

windows10-2004-x64

1

Analysis

  • max time kernel
    784178s
  • max time network
    155s
  • platform
    android_x64
  • resource
    android-x64-20230824-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20230824-enlocale:en-usos:android-10-x64system
  • submitted
    25-08-2023 22:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5d1db00b48f6bc240ede17b8a92d1eebd4d5400f60ffb272976364cd341054a0.apk

  • Size

    2.2MB

  • MD5

    0e920c52bcbb2e2edf8eda79d9b041a2

  • SHA1

    73d6992c1ff73325bf768bca25526157c9a9420c

  • SHA256

    5d1db00b48f6bc240ede17b8a92d1eebd4d5400f60ffb272976364cd341054a0

  • SHA512

    2bd973f64d377a25b6f18aaaee1249c9f4d9701a72e5f27a6d6dcb721e5288b119161d003fc863b7f74be9f06d698276f1506e997e60c98865805a51acb0e869

  • SSDEEP

    49152:g/mJkKqsduCfSWibt7gbx2X4oj5mNjE+QjLBHNXryNw8fOkcEYZuKVhTNORRopSE:g/DKqq9fSpJsVirmNjE+Qj1HNXryNw8Q

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://girisapi5698.pw

rc4.plain

Extracted

Family

alienbot

C2

http://girisapi5698.pw

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 1 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Removes its main activity from the application launcher 8 IoCs
    stealthtrojan
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.false.degree
    1⤵
    • Makes use of the framework's Accessibility service.
    • Removes its main activity from the application launcher
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    PID:5102
    • getprop ro.miui.ui.version.name
      2⤵
        PID:5289
      • getprop ro.miui.ui.version.name
        2⤵
          PID:5372
        • getprop ro.miui.ui.version.name
          2⤵
            PID:5498
          • getprop ro.miui.ui.version.name
            2⤵
              PID:5603
            • getprop ro.miui.ui.version.name
              2⤵
                PID:5635
              • getprop ro.miui.ui.version.name
                2⤵
                  PID:5663
                • getprop ro.miui.ui.version.name
                  2⤵
                    PID:5700

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • /data/data/com.false.degree/app_DynamicOptDex/nQskRt.json
                  Filesize

                  238KB

                  MD5

                  e4af42f6db2cb07d590b1cdf33c163fb

                  SHA1

                  ab0f197a9b67cf8fdc142f11fb0f0f201269f89e

                  SHA256

                  c4e3139f185da34a6e6b85c3c1b6fe715e92086189776dc5c809c215df361238

                  SHA512

                  79f02e653ada984a8c1c0e0bfe8f7aef2d8d79cb3504979d16022cdbcb5dea3d0e28ce4dd4366f0e4727334a3875aa7b2246e86e04509f52808884ada4c90d75

                  Download Submit

                • /data/data/com.false.degree/app_DynamicOptDex/nQskRt.json
                  Filesize

                  238KB

                  MD5

                  183d9219d93b50221d37219080b08792

                  SHA1

                  a389c867780fbd626f29e5f31fb133fa3ead6f27

                  SHA256

                  72d4aad82e849789360549dbd59f2e0d8ea7e70e9979fa03f3f6a082694f418c

                  SHA512

                  ccfd6f42bd8e00a7d9a084849e6e534795371e950039a2fa5552006999048773b27c6a9d4be075913b7fc1deffadfae87aeff7b0d23088be7073b22ae6766adb

                  Download Submit

                • /data/data/com.false.degree/app_DynamicOptDex/oat/nQskRt.json.cur.prof
                  Filesize

                  449B

                  MD5

                  f21ac5a7699a50b4b5f4ec85a9e2b29f

                  SHA1

                  9c0d8ea53641a305f94d212bfa41f521d25c02b0

                  SHA256

                  571045580cfee7b3f5e98086e8a625d98338c78778d5500ca858aff6f871103f

                  SHA512

                  241236b19f1f16c7038bcc6059c91921629af3d51b0b592a7f47e65e4aa920f17d84bbdd1662611312d77b3d7bfee8e9d537fcc8e1c5d2644e3bfbc546959321

                  Download Submit

                • /data/user/0/com.false.degree/app_DynamicOptDex/nQskRt.json
                  Filesize

                  483KB

                  MD5

                  ca99eaadef4d10c4f8e632887a2efce2

                  SHA1

                  252a8a270ff8702532f9f2b1e206e6c0ab2bd351

                  SHA256

                  78c531f34a9290f28cbb7ba2fdbd7a92c9c3c8d217321a05a83a193eae5df488

                  SHA512

                  30bc73b450c7eeee28f233ca70fafb90a1271d44fed124630b33c634db6491bde8b2789e78b64ca528481d832db4a36964feb6434dddc9872f21ceb42a571eb1

                  Download Submit